From cff94ea40f3959d5f77451b9d72365db44e8d153 Mon Sep 17 00:00:00 2001
From: Samuel Karp <samuelkarp@google.com>
Date: Wed, 11 Feb 2026 16:39:39 -0800
Subject: [PATCH] ctr: add --scrub-logs flag for Windows

Adds a new --scrub-logs flag to ctr run on Windows. This flag enables
the ScrubLogs option for the io.containerd.runhcs.v1 shim.

Assisted-by: gemini-cli
Signed-off-by: Samuel Karp <samuelkarp@google.com>
(cherry picked from commit 18a01c0020c5d9bdb6d6d4850ffb37b74e6959ee)
---
 cmd/ctr/commands/run/run_windows.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/cmd/ctr/commands/run/run_windows.go b/cmd/ctr/commands/run/run_windows.go
index fa0d5e7ccc..c0d504a86c 100644
--- a/cmd/ctr/commands/run/run_windows.go
+++ b/cmd/ctr/commands/run/run_windows.go
@@ -38,6 +38,10 @@ var platformRunFlags = []cli.Flag{
 		Name:  "isolated",
 		Usage: "Run the container with vm isolation",
 	},
+	&cli.BoolFlag{
+		Name:  "scrub-logs",
+		Usage: "Scrub sensitive information from the shim logs (Windows only)",
+	},
 }
 
 // NewContainer creates a new container
@@ -172,9 +176,13 @@ func NewContainer(ctx gocontext.Context, client *containerd.Client, context *cli
 	runtime := context.String("runtime")
 	var runtimeOpts interface{}
 	if runtime == "io.containerd.runhcs.v1" {
-		runtimeOpts = &options.Options{
+		opts := &options.Options{
 			Debug: context.GlobalBool("debug"),
 		}
+		if context.IsSet("scrub-logs") {
+			opts.ScrubLogs = context.Bool("scrub-logs")
+		}
+		runtimeOpts = opts
 	}
 	cOpts = append(cOpts, containerd.WithRuntime(runtime, runtimeOpts))